Skip to content

Commit 4e6697a

Browse files
JacobBarthelmehJacobBarthelmeh
committed
move base implementation from port/posix to src/wh_auth_base.c and add test that authorization callback override is being called when set
1 parent 0050bdd commit 4e6697a

4 files changed

Lines changed: 99 additions & 113 deletions

File tree

‎examples/posix/wh_posix_server/wh_posix_server_cfg.c‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
#include "wolfhsm/wh_flash_ramsim.h"
1717
#ifdef WOLFHSM_CFG_ENABLE_AUTHENTICATION
1818
#include "wolfhsm/wh_auth.h"
19-
#include "port/posix/posix_auth.h"
19+
#include "wolfhsm/wh_auth_base.h"
2020
#endif /* WOLFHSM_CFG_ENABLE_AUTHENTICATION */
2121

2222
#include "port/posix/posix_transport_shm.h"
@@ -659,17 +659,17 @@ int wh_PosixServer_ExampleNvmConfig(void* conf, const char* nvmInitFilePath)
659659
#ifdef WOLFHSM_CFG_ENABLE_AUTHENTICATION
660660
/* Default auth callback structure */
661661
static whAuthCb default_auth_cb = {
662-
.Init = posixAuth_Init,
663-
.Cleanup = posixAuth_Cleanup,
664-
.Login = posixAuth_Login,
665-
.Logout = posixAuth_Logout,
666-
.CheckRequestAuthorization = posixAuth_CheckRequestAuthorization,
667-
.CheckKeyAuthorization = posixAuth_CheckKeyAuthorization,
668-
.UserAdd = posixAuth_UserAdd,
669-
.UserDelete = posixAuth_UserDelete,
670-
.UserSetPermissions = posixAuth_UserSetPermissions,
671-
.UserGet = posixAuth_UserGet,
672-
.UserSetCredentials = posixAuth_UserSetCredentials};
662+
.Init = wh_Auth_BaseInit,
663+
.Cleanup = wh_Auth_BaseCleanup,
664+
.Login = wh_Auth_BaseLogin,
665+
.Logout = wh_Auth_BaseLogout,
666+
.CheckRequestAuthorization = NULL, /* authorization override not used */
667+
.CheckKeyAuthorization = NULL,
668+
.UserAdd = wh_Auth_BaseUserAdd,
669+
.UserDelete = wh_Auth_BaseUserDelete,
670+
.UserSetPermissions = wh_Auth_BaseUserSetPermissions,
671+
.UserGet = wh_Auth_BaseUserGet,
672+
.UserSetCredentials = wh_Auth_BaseUserSetCredentials};
673673
static whAuthContext auth_ctx = {0};
674674

675675
/**
@@ -721,7 +721,7 @@ int wh_PosixServer_ExampleAuthConfig(void* conf)
721721
for (i = 0; i < WH_AUTH_MAX_KEY_IDS; i++) {
722722
permissions.keyIds[i] = 0;
723723
}
724-
rc = posixAuth_UserAdd(&auth_ctx, "admin", &out_user_id, permissions,
724+
rc = wh_Auth_BaseUserAdd(&auth_ctx, "admin", &out_user_id, permissions,
725725
WH_AUTH_METHOD_PIN, "1234", 4);
726726
if (rc != WH_ERROR_OK) {
727727
WOLFHSM_CFG_PRINTF("Failed to add admin user: %d\n", rc);

port/posix/posix_auth.c renamed to src/wh_auth_base.c

Lines changed: 25 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232

3333
#include "wolfhsm/wh_message.h"
3434
#include "wolfhsm/wh_message_auth.h"
35-
#include "posix_auth.h"
35+
#include "wolfhsm/wh_auth_base.h"
3636

3737
/* hash pin with use as credentials */
3838
#ifndef WOLFHSM_CFG_NO_CRYPTO
@@ -58,7 +58,7 @@ static whAuthBase_User users[WH_AUTH_BASE_MAX_USERS];
5858
#include <wolfssl/wolfcrypt/asn.h>
5959
#endif
6060

61-
int posixAuth_Init(void* context, const void* config)
61+
int wh_Auth_BaseInit(void* context, const void* config)
6262
{
6363
(void)context;
6464
(void)config;
@@ -67,13 +67,13 @@ int posixAuth_Init(void* context, const void* config)
6767
return WH_ERROR_OK;
6868
}
6969

70-
int posixAuth_Cleanup(void* context)
70+
int wh_Auth_BaseCleanup(void* context)
7171
{
7272
(void)context;
7373
return WH_ERROR_OK;
7474
}
7575

76-
static whAuthBase_User* posixAuth_FindUser(const char* username)
76+
static whAuthBase_User* wh_Auth_BaseFindUser(const char* username)
7777
{
7878
int i;
7979
for (i = 0; i < WH_AUTH_BASE_MAX_USERS; i++) {
@@ -85,7 +85,7 @@ static whAuthBase_User* posixAuth_FindUser(const char* username)
8585
}
8686

8787
/* Hash PIN credentials using SHA256 (if crypto is available) */
88-
static int posixAuth_HashPin(const void* pin, uint16_t pin_len,
88+
static int wh_Auth_BaseHashPin(const void* pin, uint16_t pin_len,
8989
unsigned char* hash_out)
9090
{
9191
#ifndef WOLFHSM_CFG_NO_CRYPTO
@@ -105,7 +105,7 @@ static int posixAuth_HashPin(const void* pin, uint16_t pin_len,
105105
#endif /* WOLFHSM_CFG_NO_CRYPTO */
106106
}
107107

108-
static whAuthBase_User* posixAuth_CheckPin(const char* username, const void* auth_data,
108+
static whAuthBase_User* wh_Auth_BaseCheckPin(const char* username, const void* auth_data,
109109
uint16_t auth_data_len)
110110
{
111111
whAuthBase_User* found_user;
@@ -114,7 +114,7 @@ static whAuthBase_User* posixAuth_CheckPin(const char* username, const void* aut
114114
int rc;
115115

116116
/* Process auth_data: hash if crypto enabled, copy if disabled */
117-
rc = posixAuth_HashPin(auth_data, auth_data_len, authCheck);
117+
rc = wh_Auth_BaseHashPin(auth_data, auth_data_len, authCheck);
118118
if (rc != WH_ERROR_OK) {
119119
return NULL;
120120
}
@@ -124,7 +124,7 @@ static whAuthBase_User* posixAuth_CheckPin(const char* username, const void* aut
124124
authCheck_len = auth_data_len;
125125
#endif /* WOLFHSM_CFG_NO_CRYPTO */
126126

127-
found_user = posixAuth_FindUser(username);
127+
found_user = wh_Auth_BaseFindUser(username);
128128
if (found_user != NULL && found_user->method == WH_AUTH_METHOD_PIN &&
129129
found_user->credentials_len == authCheck_len &&
130130
memcmp(found_user->credentials, authCheck, authCheck_len) == 0) {
@@ -134,7 +134,7 @@ static whAuthBase_User* posixAuth_CheckPin(const char* username, const void* aut
134134
}
135135

136136
#if defined(WOLFHSM_CFG_CERTIFICATE_MANAGER) && !defined(WOLFHSM_CFG_NO_CRYPTO)
137-
static int posixAuth_VerifyCertificate(whAuthBase_User* found_user,
137+
static int wh_Auth_BaseVerifyCertificate(whAuthBase_User* found_user,
138138
const uint8_t* certificate,
139139
uint16_t certificate_len)
140140
{
@@ -160,16 +160,16 @@ static int posixAuth_VerifyCertificate(whAuthBase_User* found_user,
160160
return rc;
161161
}
162162

163-
static whAuthBase_User* posixAuth_CheckCertificate(const char* username,
163+
static whAuthBase_User* wh_Auth_BaseCheckCertificate(const char* username,
164164
const void* auth_data,
165165
uint16_t auth_data_len)
166166
{
167167
whAuthBase_User* found_user;
168-
found_user = posixAuth_FindUser(username);
168+
found_user = wh_Auth_BaseFindUser(username);
169169
if (found_user != NULL &&
170170
found_user->method == WH_AUTH_METHOD_CERTIFICATE &&
171171
found_user->credentials_len > 0) {
172-
if (posixAuth_VerifyCertificate(found_user, auth_data, auth_data_len) ==
172+
if (wh_Auth_BaseVerifyCertificate(found_user, auth_data, auth_data_len) ==
173173
WH_ERROR_OK) {
174174
return found_user;
175175
}
@@ -178,7 +178,7 @@ static whAuthBase_User* posixAuth_CheckCertificate(const char* username,
178178
}
179179
#endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER && !WOLFHSM_CFG_NO_CRYPTO */
180180

181-
int posixAuth_Login(void* context, uint8_t client_id, whAuthMethod method,
181+
int wh_Auth_BaseLogin(void* context, uint8_t client_id, whAuthMethod method,
182182
const char* username, const void* auth_data,
183183
uint16_t auth_data_len, whUserId* out_user_id,
184184
whAuthPermissions* out_permissions, int* loggedIn)
@@ -195,11 +195,11 @@ int posixAuth_Login(void* context, uint8_t client_id, whAuthMethod method,
195195
(void)client_id;
196196
switch (method) {
197197
case WH_AUTH_METHOD_PIN:
198-
current_user = posixAuth_CheckPin(username, auth_data, auth_data_len);
198+
current_user = wh_Auth_BaseCheckPin(username, auth_data, auth_data_len);
199199
break;
200200
#if defined(WOLFHSM_CFG_CERTIFICATE_MANAGER) && !defined(WOLFHSM_CFG_NO_CRYPTO)
201201
case WH_AUTH_METHOD_CERTIFICATE:
202-
current_user = posixAuth_CheckCertificate(username, auth_data, auth_data_len);
202+
current_user = wh_Auth_BaseCheckCertificate(username, auth_data, auth_data_len);
203203
break;
204204
#endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER && !WOLFHSM_CFG_NO_CRYPTO */
205205
default:
@@ -223,7 +223,7 @@ int posixAuth_Login(void* context, uint8_t client_id, whAuthMethod method,
223223
return WH_ERROR_OK;
224224
}
225225

226-
int posixAuth_Logout(void* context, uint16_t current_user_id,
226+
int wh_Auth_BaseLogout(void* context, uint16_t current_user_id,
227227
uint16_t user_id)
228228
{
229229
whAuthBase_User* user;
@@ -246,36 +246,7 @@ int posixAuth_Logout(void* context, uint16_t current_user_id,
246246
}
247247

248248

249-
int posixAuth_CheckRequestAuthorization(void* context, int err,
250-
uint16_t user_id, uint16_t group, uint16_t action)
251-
{
252-
(void)context;
253-
(void)user_id;
254-
(void)group;
255-
(void)action;
256-
257-
/* could override the error code here */
258-
/* the value passed in as 'err' is the current error code */
259-
return err;
260-
}
261-
262-
/* authorization check on key usage after the request has been parsed and before
263-
* the action is done */
264-
int posixAuth_CheckKeyAuthorization(void* context, int err, uint16_t user_id,
265-
uint32_t key_id, uint16_t action)
266-
{
267-
(void)context;
268-
(void)user_id;
269-
(void)key_id;
270-
(void)action;
271-
272-
/* could override the error code here */
273-
/* the value passed in as 'err' is the current error code */
274-
return err;
275-
}
276-
277-
278-
int posixAuth_UserAdd(void* context, const char* username,
249+
int wh_Auth_BaseUserAdd(void* context, const char* username,
279250
whUserId* out_user_id, whAuthPermissions permissions,
280251
whAuthMethod method, const void* credentials,
281252
uint16_t credentials_len)
@@ -336,7 +307,7 @@ int posixAuth_UserAdd(void* context, const char* username,
336307
#ifndef WOLFHSM_CFG_NO_CRYPTO
337308
/* Hash PIN before storing */
338309
unsigned char hash[WC_SHA256_DIGEST_SIZE];
339-
int rc = posixAuth_HashPin(credentials, credentials_len, hash);
310+
int rc = wh_Auth_BaseHashPin(credentials, credentials_len, hash);
340311
if (rc != WH_ERROR_OK) {
341312
return rc;
342313
}
@@ -365,7 +336,7 @@ int posixAuth_UserAdd(void* context, const char* username,
365336
return WH_ERROR_OK;
366337
}
367338

368-
int posixAuth_UserDelete(void* context, uint16_t current_user_id,
339+
int wh_Auth_BaseUserDelete(void* context, uint16_t current_user_id,
369340
uint16_t user_id)
370341
{
371342
whAuthBase_User* user;
@@ -385,7 +356,7 @@ int posixAuth_UserDelete(void* context, uint16_t current_user_id,
385356
return WH_ERROR_OK;
386357
}
387358

388-
int posixAuth_UserSetPermissions(void* context, uint16_t current_user_id,
359+
int wh_Auth_BaseUserSetPermissions(void* context, uint16_t current_user_id,
389360
uint16_t user_id,
390361
whAuthPermissions permissions)
391362
{
@@ -418,11 +389,11 @@ int posixAuth_UserSetPermissions(void* context, uint16_t current_user_id,
418389
}
419390

420391

421-
int posixAuth_UserGet(void* context, const char* username,
392+
int wh_Auth_BaseUserGet(void* context, const char* username,
422393
whUserId* out_user_id,
423394
whAuthPermissions* out_permissions)
424395
{
425-
whAuthBase_User* user = posixAuth_FindUser(username);
396+
whAuthBase_User* user = wh_Auth_BaseFindUser(username);
426397
if (user == NULL) {
427398
return WH_ERROR_NOTFOUND;
428399
}
@@ -433,7 +404,7 @@ int posixAuth_UserGet(void* context, const char* username,
433404
}
434405

435406

436-
int posixAuth_UserSetCredentials(void* context, uint16_t user_id,
407+
int wh_Auth_BaseUserSetCredentials(void* context, uint16_t user_id,
437408
whAuthMethod method,
438409
const void* current_credentials,
439410
uint16_t current_credentials_len,
@@ -473,7 +444,7 @@ int posixAuth_UserSetCredentials(void* context, uint16_t user_id,
473444
#ifndef WOLFHSM_CFG_NO_CRYPTO
474445
/* For PIN, hash the provided credentials before comparing */
475446
unsigned char hash[WC_SHA256_DIGEST_SIZE];
476-
int rc = posixAuth_HashPin(current_credentials, current_credentials_len, hash);
447+
int rc = wh_Auth_BaseHashPin(current_credentials, current_credentials_len, hash);
477448
if (rc != WH_ERROR_OK) {
478449
return rc;
479450
}
@@ -514,7 +485,7 @@ int posixAuth_UserSetCredentials(void* context, uint16_t user_id,
514485
#ifndef WOLFHSM_CFG_NO_CRYPTO
515486
/* Hash PIN before storing */
516487
unsigned char hash[WC_SHA256_DIGEST_SIZE];
517-
int rc = posixAuth_HashPin(new_credentials, new_credentials_len, hash);
488+
int rc = wh_Auth_BaseHashPin(new_credentials, new_credentials_len, hash);
518489
if (rc != WH_ERROR_OK) {
519490
return rc;
520491
}

‎test/wh_test_auth.c‎

Lines changed: 46 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
#ifdef WOLFHSM_CFG_ENABLE_AUTHENTICATION
3434
#include "wolfhsm/wh_auth.h"
3535
#include "wolfhsm/wh_message_auth.h"
36-
#include "port/posix/posix_auth.h"
36+
#include "wolfhsm/wh_auth_base.h"
3737
#endif /* WOLFHSM_CFG_ENABLE_AUTHENTICATION */
3838
#include "wolfhsm/wh_nvm.h"
3939
#include "wolfhsm/wh_nvm_flash.h"
@@ -85,19 +85,47 @@ static whTestNvmBackendUnion nvm_setup;
8585
static whNvmConfig n_conf[1] = {0};
8686
static whNvmContext nvm[1] = {{0}};
8787

88+
/* Test-specific authorization override callbacks to verify they are invoked */
89+
static int test_checkRequestAuthorizationCalled = 0;
90+
static int test_checkKeyAuthorizationCalled = 0;
91+
92+
static int test_CheckRequestAuthorization(void* context, int err,
93+
uint16_t user_id, uint16_t group, uint16_t action)
94+
{
95+
(void)context;
96+
(void)user_id;
97+
(void)group;
98+
(void)action;
99+
test_checkRequestAuthorizationCalled++;
100+
/* Pass through the error code unchanged */
101+
return err;
102+
}
103+
104+
static int test_CheckKeyAuthorization(void* context, int err, uint16_t user_id,
105+
uint32_t key_id, uint16_t action)
106+
{
107+
(void)context;
108+
(void)user_id;
109+
(void)key_id;
110+
(void)action;
111+
test_checkKeyAuthorizationCalled++;
112+
/* Pass through the error code unchanged */
113+
return err;
114+
}
115+
88116
/* Auth setup following wh_posix_server pattern */
89117
static whAuthCb default_auth_cb = {
90-
.Init = posixAuth_Init,
91-
.Cleanup = posixAuth_Cleanup,
92-
.Login = posixAuth_Login,
93-
.Logout = posixAuth_Logout,
94-
.CheckRequestAuthorization = posixAuth_CheckRequestAuthorization,
95-
.CheckKeyAuthorization = posixAuth_CheckKeyAuthorization,
96-
.UserAdd = posixAuth_UserAdd,
97-
.UserDelete = posixAuth_UserDelete,
98-
.UserSetPermissions = posixAuth_UserSetPermissions,
99-
.UserGet = posixAuth_UserGet,
100-
.UserSetCredentials = posixAuth_UserSetCredentials};
118+
.Init = wh_Auth_BaseInit,
119+
.Cleanup = wh_Auth_BaseCleanup,
120+
.Login = wh_Auth_BaseLogin,
121+
.Logout = wh_Auth_BaseLogout,
122+
.CheckRequestAuthorization = test_CheckRequestAuthorization,
123+
.CheckKeyAuthorization = test_CheckKeyAuthorization,
124+
.UserAdd = wh_Auth_BaseUserAdd,
125+
.UserDelete = wh_Auth_BaseUserDelete,
126+
.UserSetPermissions = wh_Auth_BaseUserSetPermissions,
127+
.UserGet = wh_Auth_BaseUserGet,
128+
.UserSetCredentials = wh_Auth_BaseUserSetCredentials};
101129
static whAuthContext auth_ctx = {0};
102130

103131
#ifndef WOLFHSM_CFG_NO_CRYPTO
@@ -167,7 +195,7 @@ static int _whTest_Auth_SetupMemory(whClientContext** out_client)
167195
for (i = 0; i < WH_AUTH_MAX_KEY_IDS; i++) {
168196
permissions.keyIds[i] = 0;
169197
}
170-
rc = posixAuth_UserAdd(&auth_ctx, TEST_ADMIN_USERNAME, &out_user_id, permissions,
198+
rc = wh_Auth_BaseUserAdd(&auth_ctx, TEST_ADMIN_USERNAME, &out_user_id, permissions,
171199
WH_AUTH_METHOD_PIN, TEST_ADMIN_PIN, strlen(TEST_ADMIN_PIN));
172200
if (rc != WH_ERROR_OK) {
173201
WH_ERROR_PRINT("Failed to add admin user: %d\n", rc);
@@ -1265,6 +1293,11 @@ int whTest_AuthMEM(void)
12651293
/* Memory transport mode */
12661294
WH_TEST_RETURN_ON_FAIL(_whTest_Auth_SetupMemory(&client_ctx));
12671295
WH_TEST_RETURN_ON_FAIL(whTest_AuthTest(client_ctx));
1296+
1297+
/* Verify that authorization callbacks were invoked during tests */
1298+
WH_TEST_PRINT("Verifying authorization override callbacks were called...\n");
1299+
WH_TEST_ASSERT_RETURN(test_checkRequestAuthorizationCalled > 0);
1300+
12681301
WH_TEST_RETURN_ON_FAIL(_whTest_Auth_CleanupMemory());
12691302

12701303
return WH_TEST_SUCCESS;

0 commit comments

Comments
 (0)